CVE-2026-74303

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-74303
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74303.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-74303
Downstream
Published
2026-08-15T05:58:05Z
Modified
2026-08-18T03:31:12Z
Summary
Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device
Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device

hu->serdev is NULL for hci_uart attached via non-serdev paths, but qca_dmp_hdr() unconditionally dereferences hu->serdev->dev.driver->name, causing a NULL pointer dereference.

Fix by guarding the dereference with a NULL check and falling back to "hci_ldisc_qca" for the non-serdev case.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74303.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
06d3fdfcdf5cefb06f2024b9d3dad356779399cf
Fixed
809230cc25dde1d6bb00de2a1eeb5f3199402fbe
Fixed
a209744230f9ce3d7a7e9a0839944f5cb5fa02a4
Fixed
e284bb94ad4512ec0bcd9b91bda99e67c507f7f8
Fixed
d54a5fb7d821b88c7c5569d450af59dafccaf414
Fixed
6b8cbcf08de0db62254d1981f83db0f94681ccd9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74303.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.6.0
Fixed
6.6.145
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.97
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.40
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74303.json"